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(U) Special Assessment: ISIL Threats Against the Homeland 



(U) Source Summary Statement 

(U/FOUO) This Special Assessment is derived from US Army operational reporting, interagency law 
enforcement bulletins, jihadist propaganda, DoD internal reviews, and open press reporting. Heavy 
reliance is placed on operational and official reporting sources, with press reporting used to validate 
information concerning high publicity incidents. This Special Assessment is a threat assessment product 
and does not represent the coordinated views of the US Army. 



(U) Overview 

(U//FOUO) This ARTIC Special Assessment provides an overview of potential threats posed by the Islamic State 
of Iraq and the Levant (ISIL), its supporters, those swayed by radical Islam, and lone offenders with the intent or 
inclination to act on ISIL's behalf. Presently, the Intelligence Community has not identified any corroborative or 
definitive extremist plots 1 focused on the US Army, its Soldiers, Government Civilians, and Family Members. 
However, terrorist groups and their supporters have the capability of conducting attacks with little to no warning 
in the Homeland and against US military installations and facilities worldwide. Given the continued rhetoric 
being issued by ISIL's media services and supporters through various social media platforms the ARTIC is 
concerned of the possibility of an attack. Soldiers, Government Civilians and Family Members are reminded to 
be vigilant of their surroundings and report suspicious activities to their respective military or local law 
enforcement. 

(U) ISIL Threatens Attacks against Civilians and Military in the Homeland; Urges Supporters 

(U//FOUO) Over the past year, ISIL has threatened violence against the United States and US interests overseas in 
response to ongoing counterterrorism pressure. Following the start of US air strikes in Iraq in early August 2014, and then 
Syria in late September 2014, ISIL supporters launched a Twitter campaign threatening retaliatory violence against the 
United States. Additionally, a recent audio message from an ISIL spokesman called, for the first time, for lone offender 
attacks in the Homeland in retaliation for US military operations in Iraq and Syria. 2 

• (U) On 22 Sep 1 4, an ISIL spokesman urged its followers to attack citizens of the US, France and other countries 
that joined the US-led coalition against the group. 3 

• (U) Based on a law enforcement bulletin citing a jihadist tweet ISIL has called on lone offenders in the US to use 
the "yellow pages," social media sites like Facebook, Linkedin, and Twitter to find the addresses of service 
members, "show up [at their homes] and slaughter them." 4 

• (U) According to the US Government as many as 300 Americans are fighting with ISIL; an increase from an initial 
estimate of 100. There is concern that these Americans could return to the US and commit attacks using the 
skills they learned overseas. Efforts are being made to track these foreign fighters, however, those not being 
tracked by law enforcement may be able to reenter the US without raising suspicions. 5 During a news conference 
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on 22 Sep 14, a senior Obama Administration official admitted that some Americans that fought alongside ISIL 
have returned to the US. 6 

• (U) Prior to the initiation of US airstrikes against ISIL in Iraq, Twitter posts were disseminated depicting ISIL 
supporters in front of the White House in Washington, DC and the Old Republic Building in Chicago. These 
tweets stated "We are in your state, We are in your cities, We are in your streets." Another tweet added "we are 
here #america near our #target...sooooooooooooon." 7 

(U) Examples of Islamic Extremism outside the Middle East 

(U) Generally, terrorist attacks committed against Westerners occur in countries where the terrorist has a greater 
presence and freedom of movement. In the past, attacks typically consisted of spectacular, massive bombings such as 
the bombing against transportation systems in Madrid (2004) and London (2005). Recently, more attacks are taking the 
form of small scale attacks with the use of knives, small caliber weapons, and bombs that can be made "in the kitchen of 
your mom." 

• (U) Between 1 1 and 1 9 Mar 1 2, three French soldiers, as well as three Jewish children and a Jewish rabbi were 
killed by the same gunman in the towns of Toulouse and Montauban in southern France. The shooter, reportedly 
radicalized in prison, was said to have conducted the attacks in retaliation for France's involvement in 
Afghanistan, its ruling on the wear of the burqa, and his anti-Semitic views. He was subsequently killed by a 
police sniper following a several hour standoff. 8 

• (U) On 22 May 13, two al Qa'ida inspired males targeted and attacked a British soldier with knives and a meat 
cleaver in Woolwich in the southeast area of London, United Kingdom. The British soldier presented a target of 
opportunity as he walked down the street. He was attacked in broad daylight within 400 meters of the Royal 
Artillery barracks. Prior to being confronted and detained by police one attacker was videotaped stating the attack 
was "an eye for an eye, a tooth for a tooth." 9 

• (U) On 24 May 1 3, a French soldier was stabbed from behind in the neck while conducting a group patrol as part 
of a national protection program. At the time, the French Government did not want the country to jump to any 
conclusions given that this incident occurred with days of the Woolwich attack. The attacker in this incident was 
not caught and his motivations are unknown. 10 

• (U) On 1 5 Apr 1 3, two brothers detonated two pressure cooker bombs along the final stretch of the Boston 
Marathon killing three and wounding 250. A manhunt ensued resulting in the death of one suspect and the 
capture of the other. Resultant investigations determined that the brothers used detailed instructions cited in an 
online al Qa'ida in the Arabian Peninsula magazine titled Inspire.^ 

• (U) On 1 9 Sep 1 4, Australian federal and state police raided more than a dozen properties across Sydney and 
Brisbane foiling an ISIL plot to conduct beheadings in Australia. ISIL-affiliated members in Australia planned on 
videotaping the beheadings and sending the footage to ISIL media service in Iraq and Syria to disseminate via 
social media sites for propaganda purposes. 12 

(U) Potential Indicators of Attack Planning 13 

(U//FOUO) Historically, terrorists engage in substantial, long term, and detailed planning; however, despite the indicators 
typically associated with pre-operational surveillance or attack planning only a handful of terrorist plots have been 
disrupted over the years. Based on the ongoing encouragement of HVEs and lone offenders by jihadists it is possible that 
long term planning may be abbreviated to conduct an attack with little or no warning. It is during this period that observant 
law enforcement or by-standers may identify some kind of rudimentary pre-operational activity. Possible indicators of pre- 
operational surveillance or attack planning include: 

• (U) Unusual interest in sensitive information about security measures, personnel, entry points, peak days/hours of 
operation, and access controls such as alarms or locks 

• (U) Engaging in overtly suspicious actions to provoke and observe responses by public safety personnel 

• (U) Discreet use of cameras or video recorders, sketching, or note-taking consistent with surveillance 

• (U) Observation of, or questions about facility air conditioning, heating, and ventilation systems 

• (U) Repeated visits by the same subjects, including attempts to disguise appearance from visit to visit 

• (U) Attempted or unauthorized access to rooftops or other sensitive areas 

• (U) Observation of or unusual questions about security measures, such as staffing, barriers, restricted areas, 
cameras, and intrusion detection systems 

• (U) Multiple false alarms or fictitious emergency calls to the same locations or similar venues 

• (U) Unusual interest in speaking with building maintenance personnel 

• (U) Observation of security reaction drills or procedures 
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• (U) Attention to or avoidance of surveillance cameras 

• (U//FOUO) Garments not appropriate for weather/seasons 

(U//FOUO) Each indicator may occur singularly, under the guise of lawful conduct or behavior, and may even be 
considered a constitutional exercise of rights and freedoms as guaranteed by the US Constitution. Suspicious indicators 
may also be explained or downgraded by would-be perpetrators with explanations that paint their activities as innocent 
and unplanned. For this reason, no single indicator should be used as the sole basis for law enforcement action; instead, 
the totality of observed indicators, behaviors, circumstances and details should be evaluated when considering any law 
enforcement response or action. 

(U) Social Media Precautions 14 15 

(U) Think before you post. Always assume everyone in the world will be able to see what you are posting, or tweeting, 
even if the site limits your posts to your friends and family. 

• (U) Limit who can view your social media sites; but do not trust these settings as absolute 

• (U) Avoid posting your home or work address and phone numbers; and any government or military affiliation 

• (U) Avoid providing detailed accounts of your day (e.g., when you leave for or return from work) 

• (U) Never allow applications to geolocate your location 

(U) Physical/Home Security Precautions 16 

(U) While most of these measures are primarily geared toward home burglaries, when implemented these same 
measures can help prevent an individual from conducting an attack while you or your family members are home. 
(U) Always lock doors, windows and garages 

(U) Make sure home entrances are well-lighted, and minimize bushes where intruders can hide before their 
ambush 

(U) Use the peephole before opening the door to anyone 
(U) Don't use the chain latch to open the door part-way 
(U) Don't open the door to solicitors or strangers 

(U) Install solid-core doors, heavy-duty locks and window security systems 
(U) Establish a safehaven 

(U) Hold a family meeting to work out home security plans 
(U) Conclusion 

(U//FOUO) The ARTIC reminds that it is imperative to be aware of your surroundings and report all suspicious activity to 
the appropriate authorities; report criminal threat information and suspicious activity to local law enforcement authorities 
and your chain of command; report Counterintelligence (CI) information by calling 1 -800-CALL-SPY or use the online CI 
incident report link (iSALUTE) within AKO at https://www.inscom.army.mil/isalute/ . 



The ARTIC, CIOC, and ACIC-FPTAB welcome your comments and suggestions. 
Please help us to create a better product by providing your feedback. 



NSTS (Secure): 960-1 709 TSVOIP: 984-5527 24/7: (703) 695-5300 DSN: (31 2) 225-5300 

ARTIC Commercial (STE): (703) 697-8647 
ARTIC NIPR Email: usarmv.pentagon.hqda-dcs-g-2.list.dami-artic@mail.mil 
SIPR Email: usarmv. pentagon. hqda-dcs-g-2. list. dami-ARTIC @mail. smil.mil 
NIPR Portal: https://west.esps.disa.mil/army/sites/APP/OPMG/OPS/antiterror/ARTIC 
SIPR Portal: http://army.daiis.mi.army.smil.mil/org/ARTIC 

USACIDC-CIOC NIPR Email: usarmy.belvoir.usacidc.mbx.watch-analytical-center@mail.mil 

This product supports Campaign Objective 4.0, Support Global Operations with Ready Land Power; and Major Objective 4-4, Protect the Army. 
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